agenttesla

General

Target
Inquiry.gz
Size 19KB
Sample240223-rrfxtsba49
SHA256 febeee17b021f90e16065538d31a869257713e56cd7f2fe472c1e0226b8f50cd
MD5 dfaaa0873ed31197a22997a255c9f901
SHA1 0d526711a75d4c0bcf2e9f67e10e8d55c01a5ece
SHA512 a4c1c197960b44aa366743c4d30dd72d3d1f0fd7baec8193534a28d5cfec399d198e60a221ce5b8ce7e04537c058000e6fb64093b931695bc6768490d759ce7e
SSDEEP 384:Tx/+G8NIl2BLD/FDvX2H363Ik/vucmFuSc5gtpuVZWLzlhk:T0GwIlqLzFDf2KLvuWapuVms
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.supplyvan.xyz
Port
587
Username
[email protected]
Password
Ifeanyi1987@
Email to
[email protected]

Targets

- Target
  Inquiry.exe
- Size 40KB
- SHA256 32272f676a500007b4321f7c076ec3169305615e230dad3d89c63e0cfd24c1c6
- MD5 26c95e5acba77d7fd14d109c94f75cca
- SHA1 56359d96cd63d66b51eb49acd46d8df25f170c30
- SHA512 6b2bd0a6240a13b641d005dc34cd364fd5eb2bb861d49d33bf826766ea0daf4a264f1182905363720b6a8bfad03d97386e965863578e57cf2cf5403d1309363a
- SSDEEP 768:1pc7ngE+7L+Phy83dWrz7lwHZjl7GdoUNIBBv5r:1Aj+7100rz7lwHj7QSBvJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

agenttesla discovery keylogger spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Contacts a large (4453) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Contacts a large (4453) amount of remote hosts

Creates a large amount of network flows

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2